Dome9 Integration With Slack

Properly logging and storing your security access logs is always important, and Dome9 logs are no exception to this. Through our SNS integration, customers are already able to take events and push them into the log management or SIEM tool of their choice. Sometimes though, instead of just pushing to a SIEM you might want to send the events to Slack as well for quick, real time updates. This is exactly what one of our customers asked for, so I thought I’d share the process with you. All images in this blog are clickable for a zoomed perspective.

Because Dome9 events integrate with SNS, sending them to Slack is easy to do via Lambda. This is a slightly modified and expanded version of the instructions on the AWS cloudwatch-to-lambda blueprint.

*Optional* You can add in a third variable to reduce alerting noise. The filter is called messageTypeBlacklist and you can add in a pipe delimited list of event types that you don’t want to alert on. The most common are InstanceStateChanged InstanceCreatedEvent and InstanceTagsChangeDetectedEvent.

In the Role choose ‘Create new role from template(s) and give it a name:

Leave the rest of the settings alone and save the function.

Time to test! Try logging out/back in or creating a Dome9 Dynamic Access Lease. You should see something like this in Slack: